mjml-group

mjml-group appears to be a healthy, actively maintained release from a mature project: it has 136 releases over more than 10 years, 25 releases in the last 12 months, a current stable major version, an unarchived organization-owned repository, recent commits from six contributors, and active pull-request maintenance. The package is MIT licensed, has no install lifecycle scripts, and uses a modest runtime dependency set. Confidence is reduced slightly by absent build provenance and security policy, incomplete workflow token-permission declarations, the absence of packaged tests and a changelog (although repository tests and GitHub Releases compensate for those gaps), and the repository not explicitly naming this package in its README as a monorepo subpackage.

Latest 5.4.1

NPM

88%

Total Score

Maintainer Stability

100

Dependencies

100

Maturity

Supply Chain

Attestations

Health Score Breakdown

Build provenance

No build attestation or trusted-publisher provenance is present, leaving publication integrity less transparent even though other maintenance signals are strong.

Repo package mention

The repository name does not match the package and its README does not mention mjml-group; while the name mismatch is normal for a monorepo subpackage, the lack of a README mention creates some uncertainty that the repository directly corresponds to the package.

Repo tooling

The repository uses Babel and npm build tooling, but no security scanning tools were detected; the missing security automation is a modest transparency and defense-in-depth gap.

Security policy

No repository security policy was found, reducing documented vulnerability-reporting transparency, although active maintenance and workflow hygiene partly mitigate the concern.

Token permissions

All three workflows lack top-level permissions declarations and none declares read-only permissions, leaving least-privilege behavior less explicit despite no top-level write declarations.